PT-2021-11427 · Dex · Dex

Published 2021-04-14 · Updated 2021-12-20 · CVE-2020-27847

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: dex versions prior to 2.27.0

Description: A flaw in the SAML connector of the dex library allows an attacker to bypass SAML authentication, posing a threat to confidentiality, integrity, and system availability. This issue arises due to the behavior of encoding/xml, where a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, making an unsigned document appear signed.

Recommendations: For versions prior to 2.27.0, update to version 2.27.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SAML connector until a patch is applied. Avoid using the SAML connector for authentication until the issue is resolved.

Fix

Authentication Bypass by Spoofing

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-290

CWE-347

CWE-228

Related Identifiers

CVE-2020-27847

GHSA-2X32-JM95-2CPX

GHSA-M9HP-7R99-94H5

GO-2020-0050

Affected Products

Dex

References · 18

• https://github.com/dexidp/dex/security/advisories/GHSA-m9hp-7r99-94h5 · Patch
• https://osv.dev/vulnerability/CVE-2020-27847 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2020-0050 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27847 · Security Note
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26290 · Security Note
• https://osv.dev/vulnerability/GHSA-m9hp-7r99-94h5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2x32-jm95-2cpx · Vendor Advisory
• https://github.com/dexidp/dex/releases/tag/v2.27.0 · Note
• https://github.com/dexidp/dex/commit/324b1c886b407594196113a3dbddebe38eecd4e8 · Note
• https://github.com/russellhaering/goxmldsig/commit/f6188febf0c29d7ffe26a0436212b19cb9615e64 · Note
• https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7 · Note
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md · Note
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md · Note
• https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md · Note